anyboxhq / everything-okjson

Submit your feature requests or bug reports here.
https://docs.okjson.app
Apache License 2.0
10 stars 0 forks source link

JSONPath expressions modify the structure being queried. #27

Closed shames0 closed 1 year ago

shames0 commented 1 year ago

Describe the bug If you query a JSON structure using the "Query with JSONPath" feature of OK JSON, and use a single = rather than a double == to test equivalence, an assignment occurs behind the scenes and subsequent queries in the same window become inaccurate.

To Reproduce Given the JSON list:

[
  {
    "foo": "Bar",
    "baz": 3
  }
]

If you "Query with JSONPath" starting from the root node with the following query, the result is expectedly undefined:

$.[?(@.foo == "bing")]

But if you first run this query (without knowing what your'e doing), an assignment takes place and the structure being queried is modified:

$.[?(@.foo = "bing")]

You can confirm that something was modified when you run the first query again in the same window and find that it surprisingly yields results:

$.[?(@.foo == "bing")]

RESULTS

[
  {
    "foo": "bing",
    "baz": 3
  }
]

Expected behavior The queried structure should not be mutated by a query expression

Screenshots image

Additional context Using OK JSON Version 2.4 (111)

francisfeng commented 1 year ago

I think it’s expected as you can see the preventEval option is false by default in README - JSONPath.

preventEval (default: false) - Although JavaScript evaluation expressions are allowed by default, for security reasons (if one is operating on untrusted user input, for example), one may wish to set this option to true to throw exceptions when these expressions are attempted.

If I set preventEval to true in development and run the query string again, I will get an error Eval [?(expr)] prevented in JSONPath expression..

So the question is, should I change “Query with JSONPath“ to something like “Process with JSONPath“.

I intend to keep it unchanged because I will also be introducing “Process with jq“ in the next release. So these two things need to be a little more different.